freeipa.git/daemons/ipa-kdb, branch webui_isolate

Clean / ignore make check artefact

2017-01-18T08:19:15+00:00

In tree runs of make check leave some artifacts around. The patch adds
them to make clean and .gitignore.

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Babinsky 
Reviewed-By: Martin Basti

ipa-kdb: search for password policies globally

2016-12-15T16:32:33+00:00

With the CoS templates now used to create additional password policies
per object type that are placed under the object subtrees, DAL driver
needs to search for the policies in the whole tree.

Individual policies referenced by the krbPwdPolicyReference attribute
are always searched by their full DN and with the base scope. However,
when KDC asks a DAL driver to return a password policy by name, we don't
have any specific base to search. The original code did search by the
realm subtree.

Fixes https://fedorahosted.org/freeipa/ticket/6561

Reviewed-By: Martin Babinsky

Build: remove incorrect use of MAINTAINERCLEANFILES

2016-11-16T08:12:07+00:00

Automake manual section 13 What Gets Cleaned says that make maintainer-clean
should not remove files necessary for subsequent runs of ./configure.

It practically means that all usage of MAINTAINERCLEANFILES were incorrect
so I've removed them.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Lukas Slebodnik 
Reviewed-By: Christian Heimes

Support DAL version 5 and version 6

2016-11-10T12:25:51+00:00

https://fedorahosted.org/freeipa/ticket/6466

Signed-off-by: Simo Sorce 
Reviewed-By: Tomas Krizek 
Reviewed-By: Robbie Harwood

Build: fix distribution of daemon/ipa-kdb files

2016-11-09T12:08:32+00:00

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

Build: fix Makefile.am files to separate source and build directories

2016-11-09T12:08:32+00:00

This is step forward working VPATH builds which cleanly separate sources
and build artifacts. It makes the system cleaner and easier to
understand.

Python and web UI likely require more work to make VPATH builds working.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Martin Basti 
Reviewed-By: Christian Heimes

Build: transform util directory to libutil convenience library

2016-10-24T11:30:12+00:00

This is autoconf way of doing things. It should allow us to enable
subdir-objects automake option and stay compatible with future versions
of automake.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Lukas Slebodnik 
Reviewed-By: Stanislav Laznicka 
Reviewed-By: Christian Heimes

Build: adjust include paths in daemons/ipa-kdb/tests/ipa_kdb_tests.c

2016-10-24T11:30:12+00:00

Fix include paths to prevent breakage when we move configure.ac from
daemons to the top-level.

https://fedorahosted.org/freeipa/ticket/6418

Reviewed-By: Lukas Slebodnik 
Reviewed-By: Stanislav Laznicka 
Reviewed-By: Christian Heimes

ipa-kdb: simplify trusted domain parent search

2016-08-22T12:03:00+00:00

In terms of cross-forest trust parent domain is the root domain of
the forest because we only have trust established with the forest root.

In FreeIPA LDAP store all sub-domains stored in cn=,
cn=ad,cn=trusts,... subtree. Thus, a first RDN after cn=ad is the
forest root domain. This allows us to simplify logic of finding
the parent domain.

For complex hierachical forests with more than two levels of
sub-domains, this will still be true because of the forest trust:
as forest trust is established to the forest root domain, any
communication to any sub-domain must traverse forest root domain's
domain controller.

Note that SSSD also generated incorrectly CA paths information
for forests with non-hierarchical tree-roots. In such cases
IPA KDC got confused and mistakenly assumed direct trust to the
non-hierarchical tree-root instead of going through the forest
root domain. See https://fedorahosted.org/sssd/ticket/3103 for
details.

Resolves: https://fedorahosted.org/freeipa/ticket/5738
Reviewed-By: Martin Babinsky

ipa-kdb: Allow to build with samba 4.5

2016-08-09T12:37:49+00:00

daemons/ipa-kdb/ipa_kdb_mspac.c: In function 'filter_logon_info':
daemons/ipa-kdb/ipa_kdb_mspac.c:1536:19: error: 'struct PAC_LOGON_INFO'
  has no member named 'res_group_dom_sid'
     if (info->info->res_group_dom_sid != NULL &&
                   ^~
daemons/ipa-kdb/ipa_kdb_mspac.c:1537:19: error: 'struct PAC_LOGON_INFO'
  has no member named 'res_groups'; did you mean 'resource_groups'?
         info->info->res_groups.count != 0) {
                   ^~
mv -f .deps/ipa_kdb_delegation.Tpo .deps/ipa_kdb_delegation.Plo
Makefile:806: recipe for target 'ipa_kdb_mspac.lo' failed
make[3]: *** [ipa_kdb_mspac.lo] Error 1
make[3]: *** Waiting for unfinished jobs....

Related change in samba
https://github.com/samba-team/samba/commit/4406cf792a599724f55777a45efb6367a9bd92b2

Resolves:
https://fedorahosted.org/freeipa/ticket/6173

Reviewed-By: Alexander Bokovoy